Listing of the Claims; 

Claim 1 (Currently Amended): A method of reconstructing a secret in a s e cret sharing 
sch e m e that g e n e rates , used for a case where n first shares are generated from ^ original 
secret information, n being an integer equal to or greater than two, th e n shar e s b e ing 
distributed to a group having n m e mb e rs in such a way that by using a first threshold 
secret sharing scheme, in which the original secret information can be reconstructed by a 
collection of at least any t k members from a group having n members (2 ^tjc ^ n), and 

the n shares are distributed to the n members, wherein: 

t members are collected from the n members, t being an integer equal to or 
greater than k: 

each member among the collected t members uses a second secret sharing 
scheme, in which original secret information can be reconstructed by a collection of t 
members from the collected t members, to generate t second shares from its first share, 
and distributes tha» one second share to each member among the t members including 
itself ; 

each member among the collected t members performs a distributed computation 
by using the second share distributed to itself g e n e rat e d by th e m e mb e r and the t - 1 
second shares received fi^om the t - 1 other members, the collected t members thereby 
generating t intermediate results; and 

the original secret information is reconstructed from the t intermediate results. 



-2- 



(10/798,578) 



Claim 2 (Currently Amended): The method of claim 1, wherein the first secret sharing 
scheme generates the n first shares in such a way that the original secret information is a 
sum of the n first shares. 

Claim 3 (Currently Amended): The method of claim 1, wherein the second secret sharing 
scheme generates the second shares in such a way that a first share is a sum of all the 
second shares generated fi'om the first share. 

Claim 4 (Original): The method of claim 1, wherein the intermediate result generated by 
a member is a sum of the second share generated by the member and the t - 1 second 
shares received by the member. 

Claim 5 (Original): The method of claim 1, wherein the n first shares are generated by a 
threshold secret sharing scheme using member IDs to identify each of the members. 

Claim 6 (Original): The method of claim 1, wherein the second shares are generated 
from the first share held by each of the t members by using a threshold secret sharing 
scheme using member IDs or by using a secret sharing scheme that can reconstruct the 
secret by summing all shares. 

Claim 7 (Original): The method of claim 1, wherein a member generates the 
intermediate result as a linear combination of the second share generated by the member 
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and the t - 
IDs. 



1 second shares received by the member, using coefficients based on member 



Claim 8 (Original): The method of claim 1, further comprising a step of generating and 
distributing mutually distinct temporary member IDs to the t members, wherein: 

the intermediate results for reconstructing the original secret information are 
calculated by a distributed computation using the temporary member IDs; and 

the original secret information is reconstructed from the intermediate results and 
the temporary member IDs. 

Claim 9 (Currently Amended): The method of claim 1, further comprising a step of 
generating third shares from the member IDs of the t members by using a secret sharing 
scheme, and distributing them to the t members. 

Claim 10 (Currently Amended): A shared secret reconstruction apparatus for 
reconstructing a secret in a s e cr e t sharing schem e that generat e s , used for a case where n 
first shares are generated from the original secret information, n being an integer equal to 
or greater than two, th e n shar e s being distribut e d to a group having n m e mb e rs in such a 
way that bv using a first threshold secret sharing scheme, in which t he original secret 
information can be reconstructed by a collection of at least any t k members from a group 
having n members (2 ^tjc ^ n), and the n shares are distributed to the n members, t 

members collected from the n members separately possessing the shared secret 
reconstruction apparatus , t being an integer equal to or greater than k, the shared secret 
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reconstruction apparatus thus operating together with t - 1 other shared secret 
reconstruction apparatuses, the shared secret reconstruction apparatus comprising: 

a secret sharing operation uni t, when t members are collected from the n 
members, generating second shares from a first share held by the shared secret 
reconstruction apparatus by using a (t, t) threshold secret sharing schem e, in which 
original secret information can be reconstructed by a collection of t members from the 
collected t members, and distributing the second shares to the t shared secret 
reconstruction apparatuses of the collected t members including itself : 

a secret reconstruction operation unit calculating an intermediate result for 
reconstructing the original secret information in a distributed computation by use of the 
output from the secret sharing operation unit and the second shares received from the t - 
1 other shared secret reconstruction apparatuses and transmitting the intermediate result. 

Claim 1 1 (Currently Amended): A shared secret reconstruction apparatus for 
reconstructing a secret in a s e cr e t sharing scheme that generat e s , used for a case where n 
first shares are generated from the original secret information, n being an integer equal to 
or greater than two, by using a first secret sharing scheme, th e n shares being distribut e d 
to a group having n m e mb e rs in such a way that in which the original secret information 
can be reconstructed by a collection of at least any fc t members from a group having n 
members (2 t ^ n) , and the n shares are distributed to the n members, t members 
separately possessing the shared secret reconstruction apparatus, t being an integer equal 
to or greater than k, the shared secret reconstruction apparatus thus operating together 
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with t - 1 other shared secret reconstruction apparatuses, the shared secret reconstruction 
apparatus comprising: 

a secret sharing operation unit , when t members are collected from the n 
members, generating second shares from a first share held by the shared secret 
reconstruction apparatus by using the a ft, t) threshold secret sharing scheme , in which 
original secret information can be reconstructed by a collection of t members from the 
collected t members, and distributing them to the t - 1 other shared secret reconstruction 
apparatuses; 

a secret reconstruction operation unit calculating an intermediate result for 
reconstructing the original secret information in a distributed computation by use of the 
output from the secret sharing operation unit and the second shares received from the t - 
1 other shared secret reconstruction apparatuses; and 

a secret reconstruction unit reconstructing the original secret information from 
the output from the secret reconstruction operation unit and the outputs received from the 
t - 1 other shared secret reconstruction apparatuses. 

Claim 12 (Original): The shared secret reconstruction apparatus of claim 10, further 
comprising a secret reconstruction unit reconstructing the original secret information 
from the output from the secret reconstruction operation unit and the outputs received 
from the t - 1 other shared secret reconstruction apparatuses. 
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Claim 13 (Currently Amended): The shared secret reconstruction apparatus of claim 10, 
wherein the second secret sharing scheme generates shares in such a way that the original 
secret information is a sum of all the shares. 

Claim 14 (Original): The shared secret reconstruction apparatus of claim 10, wherein the 
secret reconstruction operation unit comprises an adder summing the output from the 
secret sharing operation unit and the second shares received from the t - 1 other shared 
secret reconstruction apparatuses. 

Claim 15 (Original): The shared secret reconstruction apparatus of claim 10, wherein the 
secret sharing operation unit uses a threshold secret sharing scheme using member IDs. 

Claim 16 (Currently Amended): The shared secret reconstruction apparatus of claim 10, 
wherein the secret reconstruction operation unit comprises a linear combination operation 
unit performing a linear combination operation on the output from the secret sharing 
operation unit and the second shares received from the t - 1 other shared secret 
reconstruction apparatuses using coefficients calculated from the member IDs, the second 
shares being received via secure channels. 

Claim 17 (Original): The shared secret reconstruction apparatus of claim 10, wherein the 
secret sharing operation unit uses a threshold secret sharing scheme using temporary 
member IDs distributed to the shared secret reconstruction apparatus. 
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Claim 18 (Currently Amended): The shared secret reconstruction apparatus of claim 10, 
wherein the secret sharing operation unit generates third shares from the member ID held 
by the shared secret reconstruction apparatus by using a secret sharing scheme and 
distributes them to the t - 1 other shared secret reconstruction apparatuses, the secret 
reconstruction operation unit thereby calculating an intermediate result for the secret 
reconstruction in the distributed computation by use of the second and third shares output 
from the secret sharing operation unit and received from the t - 1 other shared secret 
reconstruction apparatuses. 

Claim 19 (Original): The shared secret reconstruction apparatus of claim 18, wherein the 
secret reconstruction operation unit comprises: 

a term calculation unit performing a distributed multiplication on the result of a 
distributed computation performed on a coefficient calculated from the third share to the 
second share and on this second share by use of the second and third shares output from 
the secret sharing operation unit and received from the t - 1 other shared secret 
reconstruction apparatuses; and 

an adder summing all the outputs from the term calculation unit. 

Claim 20 (Original): The shared secret reconstruction apparatus of claim 19, wherein the 
term calculation unit comprises: 

a difference operation unit calculating differences between the different third 

shares; 
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a first multiple term distributed multiplication unit perforaiing a distributed 
multiplication on the outputs from the difference operation unit; 

a distributed inverse element calculation unit performing a distributed 
computation on the inverse element of the output from the first multiple term distributed 
multiplication unit; 

a second multiple term distributed multiplication unit performing a distributed 
multiplication on the third shares; and 

a pair of two term distributed multiplication units performing a distributed 
multiplication on the output from the distributed inverse element calculation unit, the 
output from the second multiple term distributed multiplication unit and the 
corresponding second share. 

Claim 21 (Original): The shared secret reconstruction apparatus of claim 20, wherein 
each of the first and second multiple term distributed multiplication units comprises a 
number of two term distributed multiplication units each performing a distributed 
multiplication on two values, the number being one less than the number of values on 
which the distributed multiplication is performed. 

Claim 22 (Original): The shared secret reconstruction apparatus of claim 21, wherein 
each of the two term distributed multiplication units comprises: 
a multiplication unit multiplying two inputs; 

a secret sharing unit generating fourth shares from the output from the 
multiplication unit by using a threshold secret sharing scheme using temporary member 
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IDs and distributing them to the t - 1 other shared secret reconstruction apparatuses via 
secure channels; and 

a linear combination operation unit performing a linear combination operation 
on the output from the secret sharing unit and the fourth shares received from the t - 1 
other shared secret reconstruction apparatuses, using coefficients calculated from the 
temporary member IDs via the secure channels. 

Claim 23 (Currently Amended): The shared secret reconstruction apparatus of claim 21 , 
wherein each of the two term distributed multiplication units comprises: 

a first multiplication units each multiplying two inputs together and then 
multiplying the product by a coefficient calculated from temporary member IDs; 

first communication operation units each multiplying a first input to itself and a 
second input to a corresponding term distributed multiplication unit in another shared 
secret reconstruction apparatus by performing an oblivious transfer via the secure 
channels; 

second communication operation units each multiplying a second input to itself 
and a first input to a corresponding term distributed multiplication unit in another shared 
secret reconstruction apparatus by performing an oblivious transfer via the secure 
channels; 

first adders each summing the outputs from the first and second communication 
operation units; 

second multiplication units each multiplying the output from one of the first 
adders by a coefficient calculated from temporary member IDs; and 
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a second adder summing all the results of the first and second multiplication 

units. 

Claim 24 (Currently Amended): The shared secret reconstruction apparatus of claim 21, 
wherein each of the two term distributed multiplication unit comprises: 

a first multiplication unit multiplying first and second inputs to itself; 

first communication operation units each multiplying the first input to itself and 
a second input to a corresponding term distributed muUiplication unit in another shared 
secret reconstruction apparatuses by performing an oblivious transfer via the secure 
channels; 

second communication operation units each multiplying the second input to 
itself and a first input to a corresponding term distributed multiplication unit in another 
shared secret reconstruction apparatus by performing an oblivious transfer via the secure 
channels; 

first adders each summing the outputs from the first and second communication 
operation units; and 

a second adder summing all the results of the first multiplication unit and the 
first adders. 

Claim 25 (Original): The shared secret reconstruction apparatus of claim 20, wherein the 
distributed inverse element calculation unit comprises: 
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a number of distributed multiplication units performing a distributed 
multiplication on two values, the number being calculated from a size of a finite field 
used in the distributed multiplication; and 

a multiple term distributed multiplication unit performing distributed 
multiplication on a number of values calculated from the size of the finite field used in 
the distributed multiplication, the multiple term distributed multiplication unit including a 
number of two term distributed multiplication unit performing a distributed multiplication 
on two values, the number of the two term distributed multiplication unit being one less 
than the number of values on which the distributed multiplication is performed. 

Claim 26 (Currently Amended): The shared secret reconstruction apparatus of claim 20, 
wherein the distributed inverse element calculation unit comprises: 

a random number generation unit generating a random number; 

a first two term distributed multiplication unit performing a distributed 
multiplication on a first value and the output from the random number generation unit; 

a linear combination operation unit performing a linear combination operation 
on the output from the first two term distributed multiplication unit and output received 
from the corresponding two term distributed multiplication unit in the t - 1 other shared 
secret reconstruction apparatuses, using coefficients calculated from temporary member 
IDs, the output being received via a secure channel; 

an inverse element operation unit calculating the inverse element of the output 
from the linear combination operation unit in the finite field; 
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a secret sharing xinit generating fifth shares fi-om the output from the inverse 
element operation unit and distributing them to the t - 1 other shared secret 
reconstruction apparatuses via secure channels; and 

a second two term distributed multiplication unit receiving the fifth share from 
the secret sharing unit and the output from the random number generation unit as inputs 
and having the same structure as the first two term distributed multiplication unit. 

Claim 27 (Currently Amended): The shared secret reconstruction apparatus of claim 20, 
wherein the distributed inverse element calculation unit comprises: 

a random number generation unit generating a random number; 

a first two term distributed multiplication unit performing a distributed 
multiplication on a first value and the output from the random number generation unit; 

an adder summing the output from the first two term distributed multiplication 
unit and the outputs received from the corresponding first two term distributed 
multiplication unit in the t - 1 other shared secret reconstruction apparatuses, the outputs 
being received via secure channels; 

an inverse element operation unit calculating the inverse element of the output 
from the adder in the finite field; 

a secret sharing unit generating fifth shares from the output from the inverse 
element operation unit and distributing them to the t - 1 other shared secret 
reconstruction apparatuses via secure channels; and 



-13- 



(10/798,578) 



a second two term distributed multiplication unit receiving the fifth share from 
the secret sharing unit and the output from the random number generation unit as inputs 
and having the same structure as the first two term distributed multiplication unit. 

Claim 28 (Original): The shared secret reconstruction apparatus of claim 20, wherein the 
distributed inverse element calculation unit comprises: 

a random number generation unit generating a random number; 

a first two term distributed multiplication unit performing a distributed 
multiplication on a first value and the output firom the random number generation unit; 

a transmission unit transmitting the result of the first two term distributed 
multiplication unit to a shared secret reconstruction apparatus; 

a receiving unit for receiving the fifth share from the shared secret 
reconstruction apparatus; and 

a second two term distributed multiplication unit performing a distributed 
multiplication on the received fifth share and the output from the random number 
generation unit. 

Claim 29 (Original): A secret reconstruction system for carrying out a secret 
reconstruction method for reconstructing a secret in a secret sharing scheme that 
generates n first shares fi-om the secret information, n being an integer equal to or greater 
than two, the n shares being distributed to a group having n members in such a way that 
the original secret information can be reconstructed by a collection of any t members (2 
^ t ^ n), the secret reconstruction system comprising: 



-14- 



(10/798,578) 



a plurality of shared secret reconstruction apparatuses as described in claim 10; 

and 

a secret reconstruction apparatus reconstructing the original secret information 
from the outputs of the plurality of shared secret reconstruction apparatuses. 

Claim 30 (Original): The secret reconstruction system of claim 29, wherein the secret 
reconstruction apparatus is included in one of the plurality of shared secret reconstruction 
apparatuses. 

Claim 31 (Original): The secret reconstruction system of claim 29, wherein the secret 
reconstruction apparatus reconstructs the original secret information by summing the 
outputs of all of the plurality of shared secret reconstruction apparatuses. 

Claim 32 (Original): The secret reconstruction system of claim 29, wherein the secret 
reconstruction apparatus reconstructs the original secret information by using a 
reconstruction method of a threshold secret sharing scheme using temporary member IDs. 

Claim 33 (Original): The secret reconstruction system of claim 29, further comprising a 
temporary member ID generation unit generating mutually distinct temporary member 
IDs to the shared secret reconstruction apparatuses operated by the collected members, 
and distributing and revealing them to the shared secret reconstruction apparatuses. 
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Claim 34 (Original): The secret reconstruction system of claim 33, wherein the first 
shares are generated in such a way that the original secret information is a sum of all the 
first shares. 

Claim 35 (Original): The secret reconstruction system of claim 33, wherein the first 
shares are generated by using a threshold secret sharing scheme using member IDs. 
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